Colonial Pipeline Breach: What Does it Mean for Credit Unions?

The Colonial Pipeline ransomware attack resulted in dire consequences for consumers including price spikes, fuel shortages and panicked buying up and down the East Coast. The impact on the company was equally catastrophic – lost revenues plus extra mitigation, response and recovery expenses mean significantly reduced profits.

The supply chain for the United States fuel pipeline is essentially linear and straightforward to describe: Identify and explore a source; produce, refine and store the goods; and transport and store until it is ready for the point of sale. However, the protection of the supply chain is not always so straightforward. A complex web of technology and security controls left unmonitored leave businesses like Colonial Pipeline vulnerable.

A ransomware attack like the one on Colonial Pipeline can cripple not only a business, but entire communities, cities – the nation. The delivery of services to credit union members has a similar supply chain process, often supported by outdated technology and security. Members and businesses access their account in person or online to process transactions, make loan payments, make mobile check deposits, report fraud, make ACH payments and complete a host of critical functions required to manage personal and business needs and operations.

Every institution’s priority is to earn each member’s trust and constantly strive to exceed member expectations while not putting the institution at risk. However, that risk today extends beyond its lending and investment practices. When credit unions fail to invest in an innovative and prudent technology strategy that both harnesses the power of the platform and incorporates sophisticated security controls, a breach could result in a disruption to the supply chain that leaves members vulnerable and without access to critical financial functions.

Imagine: What would happen if a breach prevented a member from processing a loan, paying a vendor or accessing funds?

In addition to vulnerable technology infrastructure and security controls, credit unions have to worry about the target on their back placed there by the attackers. Recently, the FBI officially confirmed that DarkSide was responsible for compromising Colonial Pipeline’s networks. This group has been outspoken about their motives: Remain apolitical and make money.

While many attacks are intended to make a political statement or bring down critical infrastructure, a majority of them are driven by the goal for a big cash payout. Financial institutions are cash positive and politically neutral, and, therefore, an ideal target for hackers.

As credit unions work to provide members with evolving digital experiences and data protection, the demand is growing for strategic partners that can provide 24/7 cybersecurity services, help design technology environments and deliver cloud expertise to support a credit union’s digital transformation journey. Traditionally, financial institutions have been slower to adopt tested and secure cloud technologies than the bigger banks and fintechs. By carefully selecting cybersecurity vendors that can leverage economies of scale in data and stay ahead of threats, credit unions can design, build and manage environments securely.

What can your organization do today to begin mitigating the risks of a cyber-attack to your infrastructure and supply chain? Here are five steps to take:

1. Understand which people and tools have access to member data. Ask, what are the security practices of these vendors? Cybersecurity requires complex planning, monitoring and agility. It is never appropriate to have a one-time solution. Cybersecurity has to continuously evolve and adapt to stay one step ahead of threats. 2. Analyze your existing framework – is it nimble and agile? Are you able to easily integrate new apps and vendors? Do you have the right tools and security controls in place? 3. Build a modular environment that lays the foundation for modern networks that can handle the addition of new technologies like video and voice applications and vendors with the right security controls in place. 4. Train your staff to understand security protocols and procedures. 5. Iterate. Learn what worked from the member and employee side; determine what the successes, pain points and overall experiences were; and continue to improve on the controls, protocols and processes you have in place.

Cybersecurity is no longer just about building a strong perimeter. It is critical that credit unions have a partner that understands the nuances of the industry, the applications they use, the vendors they use, compliance and regulation requirements, and how their members interact in order to protect the industry from sophisticated hackers.

Cal Bowman is Vice President, Strategy and Innovation for Think|Stack, a Baltimore-based cybersecurity firm specializing in support for credit unions, community banks and non-profits.